Import upstream v0.16.25, stripped

Upstream commit: 3f657330c0f49a015a3a372fb59669b5cccbca6d
Enterprise-only files removed or emptied: 63
Enterprise-only snippets removed: 118 in 50 files
Dangling module declarations removed: 5
Edits turning enterprise off: 25
Third-party code: 14 files, 0 not in THIRD-PARTY.md
Renamed identifiers: 67 in 19 files
Verification: clean

The same Enterprise footprint as v0.16.24. The build check is clean
apart from the expected errors in the rebuilt-feature tests. A
bug-fix release: DKIM rotation, IMAP failed-login answers, DNSBL
multi-code scoring and negative TTLs, Pyzor on short messages, queue
quotas with an empty match, RocksDB info-log rotation, and
Autodiscover schema handling.

crates/jmap/src/registry/mapping/domain.rs

@@ -102,6 +102,10 @@ pub(crate) async fn validate_domain(
     let will_trigger_dkim = matches!(domain.dkim_management, DkimManagement::Automatic(_))
         && old_domain
             .is_none_or(|old| !matches!(old.dkim_management, DkimManagement::Automatic(_)));
+    let will_schedule_dkim = !will_trigger_dkim
+        && matches!(domain.dkim_management, DkimManagement::Automatic(_))
+        && publishes_dkim(domain)
+        && old_domain.is_some_and(|old| !publishes_dkim(old));
     let will_trigger_acme = if let DnsManagement::Automatic(details) = &domain.dns_management
         && old_domain.is_none_or(|old| !matches!(old.dns_management, DnsManagement::Automatic(_)))
     {
@@ -125,11 +129,19 @@ pub(crate) async fn validate_domain(
         }));
         on_success_renew_certificate
     } else {
+        if will_schedule_dkim {
+            tasks.push(Task::DnsManagement(TaskDnsManagement {
+                domain_id: Id::default(),
+                update_records: Map::new(vec![DnsRecordType::Dkim]),
+                on_success_renew_certificate: false,
+                status: TaskStatus::now(),
+            }));
+        }
         false
     };
 
     // Schedule DKIM key rotation task
-    if will_trigger_dkim {
+    if will_trigger_dkim || will_schedule_dkim {
         tasks.push(Task::DkimManagement(TaskDomainManagement {
             domain_id: Id::default(),
             status: TaskStatus::now(),
@@ -176,6 +188,13 @@ pub(crate) async fn validate_domain(
     Ok(Ok(response))
 }
 
+fn publishes_dkim(domain: &Domain) -> bool {
+    matches!(
+        &domain.dns_management,
+        DnsManagement::Automatic(details) if details.publish_records.contains(&DnsRecordType::Dkim)
+    )
+}
+
 pub(crate) async fn validate_dns_server(
     set: &RegistrySetResponse<'_>,
     dns: &mut DnsServer,